Live data from Hacker News

WhatsApp Messaging Interoperability

developers.facebook.com

141–150 of 152 posts

Re: WhatsApp Messaging Interoperability

#141
post #101
post #98

Earlier quoted context omitted.

The preview sends a request to some server on a Facebook subdomain. I know because I was sniffing traffic on my phone without any Facebook app installed other than WhatsApp.

Did you see the content of that domain? It might be spam/phishing protection, which can be done in a privacy-preserving way (e.g. sending only a truncated hash of the link TLD to a server and downloading a larger set of blocked domains for local filtering). At least on my Mac, I also only see connections to the URL domain, nothing to a Facebook subdomain.

There’s like 1000 reasons why the domain could be used. (For example you wouldn’t want 1M phones destroying a website because it became viral on WhatsApp, hence a caching layer is probably needed)

I don’t work at Facebook on this specific system that handles link previews so I have no idea of the details.

The fact is that if they send a request containing the link I previewed which is tied to my IP which connects to my Facebook account then they can 100% correlate that information and figure it out.

Are they doing that? Maybe, maybe not. I don’t work there. But they can if they want to so it all comes down to trust. Do you trust Meta?

Re: WhatsApp Messaging Interoperability

#142
post #118
post #96

Earlier quoted context omitted.

The WhatsApp client does give Meta a window of opportunity to get data from users. The data is otherwise E2E encrypted but when you see a link preview on WhatsApp Meta knows that.

Only the messages are encrypted, but there's a ton of metadata that isn't, e.g. who you talk to, when, where you are when you do so, ...

But in the client is the only time their code touches the actual unencrypted message data.

Also a lot of the data you mentioned will also not be available if you don’t use their client, eg: if you use Signal client then Facebook won’t get your location all as that’s not part of regular text message

Re: WhatsApp Messaging Interoperability

#143
post #36

Earlier quoted context omitted.

And that they are reluctantly complying in bad faith in the most hostile way they found. Is this going to fly? Where do these 60 days come from for instance? How is it any useful and who is going to want to implement such interoperability under such terms? This reads like a lot of words to say Fuck You Europe to me. Well, feelings are mutual, at least we are on the same page, them and me.

It seems all companies complying with EU laws (Meta and Apple) spent most resources on lawyers and accountants. To make this unattractive to users and competitors. Without additional regulations across the globe it’ll be simpler playing the geofencing game for those companies.

That'll just come back to bite them in the ass during round 2

World's most stupendous & drawn out Yak shave, if one thinks about it

Re: WhatsApp Messaging Interoperability

#144

Earlier quoted context omitted.

Has there been meaningful innovation in messaging? I had free AIM on $3 T-Zones in 2006. So I see no downsides to just forcing interoperability.

Meta and Apple are paying for far more bandwidth than what AIM was moving around back then. Very high quality videos, audio, pictures, and gifs not to mention files and group video calls.

Their will. I'm perfectly fine receiving full quality media as files, I don't need meta to reformat my media to reduce their bandwidth bill and train their model, they could redirect me to the original file if I am using another messaging app.

Re: WhatsApp Messaging Interoperability

#145
post #81

Earlier quoted context omitted.

Literally lawyering up the implementation

This is definitely their tactic, and it may work because they can be incredibly obstreperous at every turn and make the commission fight every small detail tooth and nail up to the highest court.

I don't support meta and apple's approach, but while something is done about it: I suppose you can use a (paid) vpn with servers in Europe, because meta shouldn't have access to your location by any mean beside the internet connection. Just a bandaid

Re: WhatsApp Messaging Interoperability

#146

Earlier quoted context omitted.

You may dislike it, but EU law only applies in the EU; it sounds like full compliance to me, not "bad faith" compliance. Messaging-interoperability is the one aspect of the DMA I don't support. These apps are free to download; and if you care about security (and use Signal) you'll want to avoid cross-service messaging anyway.

EU law only applies in the EU, but an actor who doesn't respect EU law outside of the EU may be refused business in the EU. I agree the precedents are not strong to propose an outright ban (eg. Coca Cola murdering trade unionists and forest defenders in South America) but it would perfectly make sense on paper.

Digital services are global. Regulation can be different from physical good regulation.

Heck, in the US even taxes are global

Edit: For US citizens

Re: WhatsApp Messaging Interoperability

#147
post #100

Earlier quoted context omitted.

Okay, but do they actually use any data from that? What does the privacy policy say? Have any effects been observed beyond "uses a facebook domain" (e.g. you see ads on Facebook for a site you had in preview)? Is there functional reason for using that domain?

Do you think I’m a Facebook employee…? Because no one else can answer your questions.

[deleted]

Re: WhatsApp Messaging Interoperability

#148

Sigh Just...use Matrix or XMPP or something ffs. The open protocols _already exist_.

They don't provide the same level of privacy that the Signal protocol does, though. Plus, I'm not sure why WhatsApp would implement a whole second protocol in the first place, they're doing this out of legal obligation, of out of free will. I have some minor hope that WhatsApp will eventually switch to MLS+MIMI, as someone from Facebook does take part in the design process, but that could also be because of Facebook…

>They don't provide the same level of privacy that the Signal protocol does, though

Can you elaborate on this please?

Re: WhatsApp Messaging Interoperability

#149

Earlier quoted context omitted.

They don't provide the same level of privacy that the Signal protocol does, though. Plus, I'm not sure why WhatsApp would implement a whole second protocol in the first place, they're doing this out of legal obligation, of out of free will. I have some minor hope that WhatsApp will eventually switch to MLS+MIMI, as someone from Facebook does take part in the design process, but that could also be because of Facebook…

>They don't provide the same level of privacy that the Signal protocol does, though Can you elaborate on this please?

Signal is built around metadata minimisation. Messages contain the absolute bare minimum information to get delivered. Because there is only one server everyone is connected to, there is almost no routing metadata attached to the encrypted binary blob. You get a key and ciphertext and that's about it. Not even Signal knows the sender metadata that's part of the message, by encrypting it. Basically all Signal knows about you is your phone number, IP address, and the last time you checked the server. It also doesn't store messages for longer than it absolutely needs to (which leads to the desktop client needing to connect to your phone or vice versa for multi device chats).

XMPP needs to have a username and server name at the very least. This is because it needs to work in a federated context, and it doesn't use things like DHTs to decentralise messages in a way that allows hiding the routing data. The message body is encrypted, of course, and headers can be minimised, but there will always be unencrypted metadata. To quote the spec:

> The OMEMO protocol does not protect against attackers who rely on metadata and traffic analysis.

As for Matrix: the message body is usually mostly encrypted, but it's leaking a lot of metadata. Message IDs sometimes fine themselves outside of the encrypted envelope as well as timestamps and other information I don't think should need to be outside the encrypted envelope.

Neither XMPP nor Matrix were designed with encryption as a first priority and that led to protocol design choices regarding metadata that cannot be altered without breaking most clients. They also tend to store messages grouped by chat group/conversation, though multi device support is technically optional for XMPP. From a server dump of either XMPP or Matrix, someone can deduce what users are chatting to what users when. In Matrix, you could deduce what messages are responses, updates, or deletions of what other messages, as well as reactions. For Signal, you'd need wiretaps on both sides to deduce that level of information.

A protocol like Signal would be near impossible to federate. That said, if federation is your goal, MIMI+MLS seems to be the future. Matrix is moving towards MLS, Google's RCS encryption already uses MLS, and MIMI and MLS are often tied together in spec definitions. I believe the XMPP people are also working on (have finished work on?) embedding MLS in XMPP as an alternative to existing encryption methods.

Re: WhatsApp Messaging Interoperability

#150
post #62

Earlier quoted context omitted.

> These apps are free to download Yes but you aren’t truly free to choose which app you download. You have to use the one being used by the people you want to message. That is of strong benefit to incumbents.

> you aren’t truly free to choose which app you download. You have to use the one Singular? You'd just use whichever app a given person is on (everyone here has 3+ chat apps installed). Wouldn't network effects only kick in when group chats are involved?

Yes, and failing that, you could simply revert to plain old SMS. IMO, a better course of action would have been forcing Whatsapp to provide an alternative way to access their group chats.

Or alternatively, forcing all phones and carriers to support RCS as a condition for certification, and funding the development of a quality FOSS RCS client.

Post reply on HN